Suspected links between a Turkish criminal network and an attack on satellite internet infrastructure in Poland have raised questions about the use of organised crime in geopolitical operations.
An attack on a Starlink internet station in Poland has raised concerns that criminal gangs operating across Europe could be drawn into operations linked to the conflict between Russia and Ukraine.
The station, located in Wola Krobowska, south of Warsaw, was set on fire on September 23, 2026. Starlink provides satellite internet connectivity to the Ukrainian military and has become an important part of the country’s defence against Russia’s invasion.
Polish authorities suspected sabotage carried out on behalf of Russian intelligence services. But arrests made in Germany have brought a new dimension to the investigation, with suspects reportedly linked to a violent Turkish criminal group known as the Daltons.
Two Turkish nationals were arrested in Nürtingen, southwestern Germany, on October 12 under a European arrest warrant. They are suspected of setting fire to the Starlink station. A third Turkish national was arrested in neighbouring Reutlingen on November 3, accused of ordering the attack.
Media reports have linked the suspects to the Daltons, a criminal network originating in Türkiye and increasingly active in Germany.
Turkish authorities also reportedly arrested 85 people linked to the group on October 27 in an operation connected to the case. Thirty-five of those arrested were minors.
The investigation has not established the full extent of the alleged links between the suspects, the Daltons and any possible geopolitical sponsors. However, the case has raised a difficult question for European security agencies: could criminal gangs known for extortion, shootings and contract killings also be recruited to carry out acts of sabotage for foreign interests?
In an analysis, Daniel Brombacher, Director of the Europe Observatory at the Global Initiative Against Transnational Organized Crime (GI-TOC), and Nele Grehn, an Associate, warn that the possible connection points to a growing overlap between organised crime and geopolitical conflict.
The spread of the Daltons
The Daltons have become a growing concern for German law enforcement amid rising gun violence and extortion.
The GI-TOC researchers say German authorities have about 460 known cases connected to the group under investigation.
Berlin recorded an increase of more than two-thirds in gun violence in 2025, with the trend continuing. A significant share of the violence is believed to be linked to extortion activities involving the Daltons and similar Turkish-origin gangs.
Their activities are not confined to Germany. The groups are also extending their operations into Switzerland and Austria, with Germany appearing to be the most affected.
The Daltons form part of a wider development often described as the Gen Z mafia, referring to criminal groups largely made up of young men, including minors, who are known for their violence and their use of social media to promote their activities.
Their operations include extortion, drug and arms trafficking, protection racketeering and contract killings. They also offer violence-for-hire services, sometimes using young recruits to carry out assignments.
The groups differ from traditional mafia organisations. Their structures are often loose, membership changes frequently and individuals of different nationalities may work together. Their social media presence, however, helps them build a reputation that can be used to intimidate victims and rivals.
Pressure from Turkish law enforcement has also contributed to the groups’ expansion beyond the country. The researchers point to a shift in their operations towards Germany and other parts of Europe, as well as Russia and Georgia.
A possible new role for criminal gangs
European authorities have dealt with Russian-linked sabotage and organised crime as separate security concerns. The Starlink investigation raises the possibility that the two are becoming connected.
According to the GI-TOC analysis, Russia has for some time recruited individuals in Europe to carry out activities such as arson, sabotage, intimidation and political violence.
Previous recruitment has largely involved Russian-speaking individuals from post-Soviet and eastern European communities, including Ukraine, the Western Balkans and Bulgaria. Ethnic Russian and Chechen networks in western Europe have also been used.
These recruits are often individuals with criminal records, paid relatively small sums to undertake specific assignments. They are generally not members of established professional criminal organisations.
The possible involvement of the Daltons would be different. The group has an established network, a reputation for violence and operations that extend across national borders.
The researchers also draw attention to the reported presence in Russia of Berat Can Gökdemir, 29, who is believed to lead the Daltons.
Gökdemir reportedly fled to Russia in 2024 after coming under pressure from Turkish authorities. He was reportedly arrested there but has not been extradited, despite requests from Türkiye.
An alleged spokesperson for the group has claimed that he lives in a safe house in Russia and continues to direct its activities.
The researchers say his reported presence in Russia raises questions about the group’s possible links to geopolitical interests. However, they do not establish that the Daltons carried out the Polish attack on behalf of Russia.
Security agencies face a wider challenge
The case highlights difficulties in Europe’s approach to emerging security threats.
Responsibility for dealing with hybrid attacks generally rests with defence institutions, intelligence services and agencies responsible for protecting critical infrastructure.
Organised crime is handled mainly by criminal police and other law enforcement bodies, often operating at national or regional levels.
This division can make it difficult to identify threats that involve both criminal networks and foreign interests.
A gang involved in extortion and contract killings may also have the capacity to organise violence across borders. If such a network is recruited to attack infrastructure or intimidate individuals on behalf of an external actor, the response would require cooperation between agencies that do not always work closely together.
The researchers also highlight the role of technology in this changing criminal environment.
Social media gives younger gangs a platform to recruit members, publicise violence and establish their reputations. Online crime-for-hire networks can also make it easier for individuals or external actors to commission criminal activities.
For the researchers, the central concern is not the technology itself, but the possibility that criminal networks and state interests could find common ground through it.
They are calling on European countries and EU member states to strengthen cooperation between law enforcement, intelligence and defence agencies so that organised crime and hybrid threats are addressed together.
The investigation into the Starlink attack is still ongoing, and the alleged links between the suspects, the Daltons and possible geopolitical sponsors have yet to be fully established.
But the case has brought into focus a security concern extending beyond the attack itself: the possibility that criminal gangs operating across Europe could become part of the machinery of geopolitical conflict.
